Riskcovery

CVE-2023-31405

Log Injection vulnerability in SAP NetWeaver AS for Java (Log Viewer)

State
Published
Severity
5.3 Medium
Published
Jul 11, 2023
Updated
Nov 8, 2024
Reserved
Apr 27, 2023

Read the record on cve.org

Description

SAP NetWeaver AS for Java - versions ENGINEAPI 7.50, SERVERCORE 7.50, J2EE-APPS 7.50, allows an unauthenticated attacker to craft a request over the network which can result in unwarranted modifications to a system log without user interaction. There is no ability to view any information or any effect on availability.

Scores

CVSSScoreVectorSource
3.15.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Nsap

Weaknesses

  • CWE-117 Improper Output Neutralization for Logs

Affected Products

ProductVersions
SAP NetWeaver AS for Java (Log Viewer)SAP_SE
  • ENGINEAPI 7.50Affected
  • SERVERCORE 7.50Affected
  • J2EE-APPS 7.50Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.